netsupport | a8fb1ad41dcc309ae011f13854730628c251e2a74649abfb2042e1be5c66fc99 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CCleaner.zip
Size 3.0MB
Sample240730-syn3fswgkn
SHA256 a8fb1ad41dcc309ae011f13854730628c251e2a74649abfb2042e1be5c66fc99
MD5 5e20913ea9a4856f07ab0af09fd90bcd
SHA1 5c6bf0e953aef84134ec21c3b94d0c615df4cafc
SHA512 9521b7027d4248e6bd29b77fd030fe34d6100af1d696bdfd8cba9e6b5cd86de20a011bd4520811c4e112860963ed2920e50db8db78b17492d14bf87d1d84f291
SSDEEP 98304:E1PFXa/hRFY89YYc9jh23redpmQR/mizhpXRX:UPSxYoY59V0redpmQR1hpF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

netsupport discovery rat

Malware Config

Targets

- Target
  HTCTL32.DLL
- Size 320KB
- SHA256 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
- MD5 c94005d2dcd2a54e40510344e0bb9435
- SHA1 55b4a1620c5d0113811242c20bd9870a1e31d542
- SHA512 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
- SSDEEP 6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  PCICHEK.DLL
- Size 18KB
- SHA256 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
- MD5 104b30fef04433a2d2fd1d5f99f179fe
- SHA1 ecb08e224a2f2772d1e53675bedc4b2c50485a41
- SHA512 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
- SSDEEP 192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  PCICL32.DLL
- Size 3.6MB
- SHA256 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
- MD5 d3d39180e85700f72aaae25e40c125ff
- SHA1 f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
- SHA512 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
- SSDEEP 49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  TCCTL32.DLL
- Size 387KB
- SHA256 2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e
- MD5 2c88d947a5794cf995d2f465f1cb9d10
- SHA1 c0ff9ea43771d712fe1878dbb6b9d7a201759389
- SHA512 e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542
- SSDEEP 12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  client32.exe
- Size 101KB
- SHA256 18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
- MD5 c4f1b50e3111d29774f7525039ff7086
- SHA1 57539c95cba0986ec8df0fcdea433e7c71b724c6
- SHA512 005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
- SSDEEP 768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

netsupport discovery rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
behavioral10 behavioral9
- Target
  msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  pcicapi.dll
- Size 32KB
- SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
- MD5 34dfb87e4200d852d1fb45dc48f93cfc
- SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
- SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
- SSDEEP 768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  remcmdstub.exe
- Size 62KB
- SHA256 fedd609a16c717db9bea3072bed41e79b564c4bc97f959208bfa52fb3c9fa814
- MD5 6fca49b85aa38ee016e39e14b9f9d6d9
- SHA1 b0d689c70e91d5600ccc2a4e533ff89bf4ca388b
- SHA512 f9c90029ff3dea84df853db63dace97d1c835a8cf7b6a6227a5b6db4abe25e9912dfed6967a88a128d11ab584663e099bf80c50dd879242432312961c0cfe622
- SSDEEP 1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

netsupportdiscoveryrat

behavioral10

netsupportdiscoveryrat

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16